Sublime Text Sessions
Overview
Section titled “Overview”Evidence: Sublime Text Sessions
Description: Collect Sublime Text Sessions & Contents
Category: Applications
Platform: windows
Short Name: sblm
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Sublime Text stores session files containing open files, cursor positions, edit history, and workspace state. These session files maintain the editor state between sessions.
Data Collected
Section titled “Data Collected”This collector gathers structured data about sublime text sessions.
Collection Method
Section titled “Collection Method”This collector gathers Sublime Text session files from the Roaming profile Local directory containing workspace and editor state information.
Forensic Value
Section titled “Forensic Value”Sublime Text sessions reveal files being edited, code projects, file paths, and editing history. This is valuable for identifying accessed code, configuration files, scripts, or documents of interest in investigations.